{"id":"CVE-2026-25645","aliases":["ALPINE-CVE-2026-25645","AZL-80996","BELL-CVE-2026-25645","CLSA-2026-1780879897","CLSA-2026-1781225614","CLSA-2026-1781225615","CLSA-2026-1787551818","DEBIAN-CVE-2026-25645","EUVD-2026-15754","GHSA-gc5v-m9x4-r6x2","OESA-2026-1791","OESA-2026-1909","PYSEC-2026-2275","ROOT-APP-PYPI-CVE-2026-25645","SUSE-SU-2026:1218-1","SUSE-SU-2026:1644-1","SUSE-SU-2026:1647-1","SUSE-SU-2026:21036-1","SUSE-SU-2026:21063-1","SUSE-SU-2026:22055-1","SUSE-SU-2026:22091-1","UBUNTU-CVE-2026-25645","USN-8825-1","openSUSE-SU-2026:10455-1","openSUSE-SU-2026:20926-1"],"status":"published","title":"Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function","description":"Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00189,"percentile":0.08608,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-377"],"published":"2026-03-25T16:56:28Z","modified":"2026-11-05T05:40:51Z","exploits":[{"source":"pocgithub","id":"Jaycelation/CVE-2026-25645","title":"Jaycelation/CVE-2026-25645","date":"2025-11-16","url":"https://github.com/Jaycelation/CVE-2026-25645"}],"fixes":[{"ecosystem":"PyPI","package":"requests","fixed_in":["2.33.0"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.20","package":"py3-requests","fixed_in":["2.33.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-requests","fixed_in":["2.33.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-requests","fixed_in":["2.33.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-requests","fixed_in":["2.33.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-requests","fixed_in":["2.33.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"python-requests","fixed_in":["2.31.0-4"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"py3-requests","fixed_in":["2.28.1-r5"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"py3-requests","fixed_in":["2.32.5-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"py3-requests","fixed_in":["2.33.1-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:PyPI","package":"requests","fixed_in":["2.32.3.post2+tuxcare","2.31.0.post2+tuxcare","2.30.0.post2+tuxcare","2.25.1.post2+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"requests","fixed_in":["2.34.2-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"python-requests","fixed_in":["2.31.0-5.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"python-requests","fixed_in":["2.31.0-5.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"python-requests","fixed_in":["2.31.0-5.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"python-requests","fixed_in":["2.24.0-6.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"python-requests","fixed_in":["2.26.0-12.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"python-requests","fixed_in":["2.31.0-5.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"python-pip","fixed_in":["21.3.1-15.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"python-pip","fixed_in":["23.3.1-10.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"python-pip","fixed_in":["23.3.1-10.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"python-pip","fixed_in":["23.3.1-10.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"python-pip","fixed_in":["23.3.1-10.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"python-pip","fixed_in":["20.2.2-16.oe2003sp4"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"rootio-requests","fixed_in":["2.32.5+root.io.1","2.32.3+root.io.2","2.28.1+root.io.1","2.28.2+root.io.1","2.30.0+root.io.1","2.29.0+root.io.1","2.30.0+root.io.2","2.32.0+root.io.1","2.32.5+root.io.2","2.32.0+root.io.2","2.32.3+root.io.3","2.32.2+root.io.1","2.32.4+root.io.1","2.31.0+root.io.2","2.31.0+root.io.3","2.32.2+root.io.2","2.28.2+root.io.2","2.31.0+root.io.4","2.32.3+root.io.4","2.30.0+root.io.3","2.32.5+root.io.3","2.29.0+root.io.2","2.32.0+root.io.3","2.32.4+root.io.2","2.28.1+root.io.2","2.17.0+root.io.4","2.17.0+root.io.5","2.25.1+root.io.6","2.32.4+root.io.3","2.32.2+root.io.3","2.32.3+root.io.5","2.32.0+root.io.4"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"requests","fixed_in":["2.28.1+aikido.1","2.29.0+aikido.1","2.28.2+aikido.2","2.31.0+aikido.4","2.32.3+aikido.4","2.30.0+aikido.3","2.32.5+aikido.3","2.29.0+aikido.2","2.32.0+aikido.3","2.32.4+aikido.2","2.28.1+aikido.2","2.17.0+aikido.4","2.17.0+aikido.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-requests","fixed_in":["2.24.0-8.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python-requests","fixed_in":["2.24.0-8.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"python-requests","fixed_in":["2.32.4-slfo.1.1_2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"python-requests","fixed_in":["2.32.3-3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"python-requests","fixed_in":["2.32.4-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-requests","fixed_in":["2.32.4-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-requests","fixed_in":["2.32.4-160000.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"requests","fixed_in":["2.22.0-2ubuntu1.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"requests","fixed_in":["2.25.1+dfsg-2ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"requests","fixed_in":["2.31.0+dfsg-1ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"requests","fixed_in":["2.32.5+dfsg-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-requests","fixed_in":["2.33.0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"python-requests","fixed_in":["2.32.4-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"py3-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.1-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.0-4"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"py3-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.28.1-r2"},{"fixed":"2.28.1-r5"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"py3-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.32.3-r0"},{"fixed":"2.32.5-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"py3-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.28.1-r2"},{"fixed":"2.33.1-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.32.3"},{"fixed":"2.32.3.post2+tuxcare"}]}],"versions":["2.32.3","2.32.3.post1+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.31.0"},{"fixed":"2.31.0.post2+tuxcare"}]}],"versions":["2.31.0","2.31.0.post1+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.30.0"},{"fixed":"2.30.0.post2+tuxcare"}]}],"versions":["2.30.0","2.30.0.post1+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.25.1"},{"fixed":"2.25.1.post2+tuxcare"}]}],"versions":["2.25.1","2.25.1.post1+tuxcare"]},{"source":"osv","ecosystem":"Debian:12","package":"requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.28.1+dfsg-1","2.31.0+dfsg-1","2.31.0+dfsg-2","2.32.3+dfsg-1","2.32.3+dfsg-2","2.32.3+dfsg-3","2.32.3+dfsg-4","2.32.3+dfsg-5","2.32.4+dfsg-1","2.32.5+dfsg-1","2.32.5+dfsg-2","2.34.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.32.3+dfsg-5","2.32.3+dfsg-5+deb13u1","2.32.4+dfsg-1","2.32.5+dfsg-1","2.32.5+dfsg-2","2.34.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.2-1"}]}],"versions":["2.32.3+dfsg-5","2.32.4+dfsg-1","2.32.5+dfsg-1","2.32.5+dfsg-2"]},{"source":"osv","ecosystem":"PyPI","package":"requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.0"}]}],"versions":["0.0.1","0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.6","0.10.7","0.10.8","0.11.1","0.11.2","0.12.0","0.12.01","0.12.1","0.13.0","0.13.1","0.13.2","0.13.3","0.13.4","0.13.5","0.13.6","0.13.7","0.13.8","0.13.9","0.14.0","0.14.1","0.14.2","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.4.0","0.4.1","0.5.0","0.5.1","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.6.6","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.8.8","0.8.9","0.9.0","0.9.1","0.9.2","0.9.3","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","1.2.0","1.2.1","1.2.2","1.2.3","2.0.0","2.0.1","2.1.0","2.10.0","2.11.0","2.11.1","2.12.0","2.12.1","2.12.2","2.12.3","2.12.4","2.12.5","2.13.0","2.14.0","2.14.1","2.14.2","2.15.0","2.15.1","2.16.0","2.16.1","2.16.2","2.16.3","2.16.4","2.16.5","2.17.0","2.17.1","2.17.2","2.17.3","2.18.0","2.18.1","2.18.2","2.18.3","2.18.4","2.19.0","2.19.1","2.2.0","2.2.1","2.20.0","2.20.1","2.21.0","2.22.0","2.23.0","2.24.0","2.25.0","2.25.1","2.26.0","2.27.0","2.27.1","2.28.0","2.28.1","2.28.2","2.29.0","2.3.0","2.30.0","2.31.0","2.32.0","2.32.1","2.32.2","2.32.3","2.32.4","2.32.5","2.4.0","2.4.1","2.4.2","2.4.3","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.7.0","2.8.0","2.8.1","2.9.0","2.9.1","2.9.2"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.0-5.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"python-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.0-5.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.0-5.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.0-6.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.0-12.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.0-5.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.3.1-15.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.1-10.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.1-10.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.1-10.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.1-10.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.2.2-16.oe2003sp4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.0"}]}],"versions":["0.0.1","0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.6","0.10.7","0.10.8","0.11.1","0.11.2","0.12.0","0.12.01","0.12.1","0.13.0","0.13.1","0.13.2","0.13.3","0.13.4","0.13.5","0.13.6","0.13.7","0.13.8","0.13.9","0.14.0","0.14.1","0.14.2","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.4.0","0.4.1","0.5.0","0.5.1","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.6.6","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.8.8","0.8.9","0.9.0","0.9.1","0.9.2","0.9.3","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","1.2.0","1.2.1","1.2.2","1.2.3","2.0.0","2.0.1","2.1.0","2.10.0","2.11.0","2.11.1","2.12.0","2.12.1","2.12.2","2.12.3","2.12.4","2.12.5","2.13.0","2.14.0","2.14.1","2.14.2","2.15.0","2.15.1","2.16.0","2.16.1","2.16.2","2.16.3","2.16.4","2.16.5","2.17.0","2.17.1","2.17.2","2.17.3","2.18.0","2.18.1","2.18.2","2.18.3","2.18.4","2.19.0","2.19.1","2.2.0","2.2.1","2.20.0","2.20.1","2.21.0","2.22.0","2.23.0","2.24.0","2.25.0","2.25.1","2.26.0","2.27.0","2.27.1","2.28.0","2.28.1","2.28.2","2.29.0","2.3.0","2.30.0","2.31.0","2.32.0","2.32.1","2.32.2","2.32.3","2.32.4","2.32.5","2.4.0","2.4.1","2.4.2","2.4.3","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.7.0","2.8.0","2.8.1","2.9.0","2.9.1","2.9.2"]},{"source":"osv","ecosystem":"Root:PyPI","package":"rootio-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.5+root.io.1"},{"fixed":"2.32.3+root.io.2"},{"fixed":"2.28.1+root.io.1"},{"fixed":"2.28.2+root.io.1"},{"fixed":"2.30.0+root.io.1"},{"fixed":"2.29.0+root.io.1"},{"fixed":"2.30.0+root.io.2"},{"fixed":"2.32.0+root.io.1"},{"fixed":"2.32.5+root.io.2"},{"fixed":"2.32.0+root.io.2"},{"fixed":"2.32.3+root.io.3"},{"fixed":"2.32.2+root.io.1"},{"fixed":"2.32.4+root.io.1"},{"fixed":"2.31.0+root.io.2"},{"fixed":"2.31.0+root.io.3"},{"fixed":"2.32.2+root.io.2"},{"fixed":"2.28.2+root.io.2"},{"fixed":"2.31.0+root.io.4"},{"fixed":"2.32.3+root.io.4"},{"fixed":"2.30.0+root.io.3"},{"fixed":"2.32.5+root.io.3"},{"fixed":"2.29.0+root.io.2"},{"fixed":"2.32.0+root.io.3"},{"fixed":"2.32.4+root.io.2"},{"fixed":"2.28.1+root.io.2"},{"fixed":"2.17.0+root.io.4"},{"fixed":"2.17.0+root.io.5"},{"fixed":"2.25.1+root.io.6"},{"fixed":"2.32.4+root.io.3"},{"fixed":"2.32.2+root.io.3"},{"fixed":"2.32.3+root.io.5"},{"fixed":"2.32.0+root.io.4"}]}]},{"source":"osv","ecosystem":"Root:PyPI","package":"requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.1+aikido.1"},{"fixed":"2.29.0+aikido.1"},{"fixed":"2.28.2+aikido.2"},{"fixed":"2.31.0+aikido.4"},{"fixed":"2.32.3+aikido.4"},{"fixed":"2.30.0+aikido.3"},{"fixed":"2.32.5+aikido.3"},{"fixed":"2.29.0+aikido.2"},{"fixed":"2.32.0+aikido.3"},{"fixed":"2.32.4+aikido.2"},{"fixed":"2.28.1+aikido.2"},{"fixed":"2.17.0+aikido.4"},{"fixed":"2.17.0+aikido.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.0-8.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.0-8.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"python-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.4-slfo.1.1_2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"python-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.3-3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"python-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.4-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.4-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.4-160000.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.1-2","1.5.4-1","1.5.4-1ubuntu1","1.5.4-1ubuntu3","1.5.4-1ubuntu4","1.5.4-1ubuntu4+esm1","1.5.4-1ubuntu4+esm2","1.5.4-1ubuntu4+esm3","1.5.4-1ubuntu4+esm4","1.5.4-1ubuntu4+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.6-7ubuntu1","1.5.6-7ubuntu2","8.0.2-7","8.0.3-1","8.0.3-2","8.1.0-1","8.1.0-2","8.1.1-1","8.1.1-2","8.1.1-2ubuntu0.1","8.1.1-2ubuntu0.2","8.1.1-2ubuntu0.4","8.1.1-2ubuntu0.6","8.1.1-2ubuntu0.6+esm2","8.1.1-2ubuntu0.6+esm3","8.1.1-2ubuntu0.6+esm4","8.1.1-2ubuntu0.6+esm5","8.1.1-2ubuntu0.6+esm6","8.1.1-2ubuntu0.6+esm8","8.1.1-2ubuntu0.6+esm10","8.1.1-2ubuntu0.6+esm11","8.1.1-2ubuntu0.6+esm12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0.1-2","9.0.1-2.3~ubuntu1","9.0.1-2.3~ubuntu1.18.04.1","9.0.1-2.3~ubuntu1.18.04.2","9.0.1-2.3~ubuntu1.18.04.3","9.0.1-2.3~ubuntu1.18.04.4","9.0.1-2.3~ubuntu1.18.04.5","9.0.1-2.3~ubuntu1.18.04.5+esm2","9.0.1-2.3~ubuntu1.18.04.5+esm3","9.0.1-2.3~ubuntu1.18.04.6","9.0.1-2.3~ubuntu1.18.04.6+esm1","9.0.1-2.3~ubuntu1.18.04.7","9.0.1-2.3~ubuntu1.18.04.7+esm1","9.0.1-2.3~ubuntu1.18.04.8","9.0.1-2.3~ubuntu1.18.04.8+esm1","9.0.1-2.3~ubuntu1.18.04.8+esm2","9.0.1-2.3~ubuntu1.18.04.8+esm4","9.0.1-2.3~ubuntu1.18.04.8+esm6","9.0.1-2.3~ubuntu1.18.04.8+esm7","9.0.1-2.3~ubuntu1.18.04.8+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.0-2ubuntu1.1+esm2"}]}],"versions":["2.21.0-1","2.22.0-2build1","2.22.0-2ubuntu1","2.22.0-2ubuntu1.1","2.22.0-2ubuntu1.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18.1-5","18.1-5build1","18.1-5ubuntu1","20.0.2-2","20.0.2-4","20.0.2-5","20.0.2-5ubuntu1","20.0.2-5ubuntu1.1","20.0.2-5ubuntu1.3","20.0.2-5ubuntu1.4","20.0.2-5ubuntu1.5","20.0.2-5ubuntu1.6","20.0.2-5ubuntu1.7","20.0.2-5ubuntu1.8","20.0.2-5ubuntu1.9","20.0.2-5ubuntu1.10","20.0.2-5ubuntu1.10+esm2","20.0.2-5ubuntu1.11","20.0.2-5ubuntu1.11+esm2","20.0.2-5ubuntu1.11+esm3","20.0.2-5ubuntu1.11+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.1+dfsg-2ubuntu0.4"}]}],"versions":["2.25.1+dfsg-2","2.25.1+dfsg-2ubuntu0.1","2.25.1+dfsg-2ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.3.4-4","21.3.1+dfsg-3","22.0.2+dfsg-1","22.0.2+dfsg-1ubuntu0.1","22.0.2+dfsg-1ubuntu0.2","22.0.2+dfsg-1ubuntu0.3","22.0.2+dfsg-1ubuntu0.4","22.0.2+dfsg-1ubuntu0.5","22.0.2+dfsg-1ubuntu0.6","22.0.2+dfsg-1ubuntu0.7","22.0.2+dfsg-1ubuntu0.7+esm1","22.0.2+dfsg-1ubuntu0.7+esm2","22.0.2+dfsg-1ubuntu0.7+esm3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.0+dfsg-1ubuntu1.2"}]}],"versions":["2.31.0+dfsg-1ubuntu1","2.31.0+dfsg-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["23.2+dfsg-1","23.3+dfsg-1","24.0+dfsg-1","24.0+dfsg-1ubuntu1","24.0+dfsg-1ubuntu1.1","24.0+dfsg-1ubuntu1.2","24.0+dfsg-1ubuntu1.3","24.0+dfsg-1ubuntu1.3+esm1","24.0+dfsg-1ubuntu1.3+esm2","24.0+dfsg-1ubuntu1.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.0+dfsg-1","25.1.1+dfsg-1","25.1.1+dfsg-1ubuntu1","25.1.1+dfsg-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.32.3+dfsg-4ubuntu1","2.32.3+dfsg-5ubuntu1","2.32.3+dfsg-5ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.1.1+dfsg-1ubuntu2","26.1.2+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.5+dfsg-1ubuntu1.1"}]}],"versions":["2.32.3+dfsg-5ubuntu2","2.32.5+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.1.1+dfsg-1ubuntu2","25.1.1+dfsg-1ubuntu2+esm1","25.1.1+dfsg-1ubuntu2+esm2","25.1.1+dfsg-1ubuntu2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.22.0-2ubuntu1.1+esm2"}]}],"versions":["2.21.0-1","2.22.0-2build1","2.22.0-2ubuntu1","2.22.0-2ubuntu1.1","2.22.0-2ubuntu1.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.1+dfsg-2ubuntu0.4"}]}],"versions":["2.25.1+dfsg-2","2.25.1+dfsg-2ubuntu0.1","2.25.1+dfsg-2ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31.0+dfsg-1ubuntu1.2"}]}],"versions":["2.31.0+dfsg-1ubuntu1","2.31.0+dfsg-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.5+dfsg-1ubuntu1.1"}]}],"versions":["2.32.3+dfsg-5ubuntu2","2.32.5+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.33.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.4-160000.3.1"}]}]}],"products":[{"vendor":"psf","product":"requests"},{"vendor":"python","product":"requests"}],"references":[{"url":"https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/psf/requests/releases/tag/v2.33.0","tags":["x_refsource_MISC","Release Notes","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25645","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-gc5v-m9x4-r6x2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-25645","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-25645","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25645.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-25645","tags":["advisory"]},{"url":"https://github.com/psf/requests","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1791","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1909","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261218-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1260589","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25645","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261644-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261647-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621036-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621063-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622055-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622091-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-25645","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25645","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8825-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-25645","title":"Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function","description":"Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.","status":"published","published":"2026-03-25T17:02:48.402Z","modified":"2026-03-25T22:48:33.406Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T13:41:30.911526Z"}],"euvd":[{"id":"EUVD-2026-15754","description":"Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.","status":"published","published":"2026-03-25T17:02:48Z","modified":"2026-03-25T22:48:33Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:28.569748Z"}],"ghsa":[{"id":"GHSA-gc5v-m9x4-r6x2","title":"Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function","description":"### Impact\nThe `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one.\n\n### Affected usages\n**Standard usage of the Requests library is not affected by this vulnerability.** Only applications that call `extract_zipped_paths()` directly are impacted.\n\n### Remediation\nUpgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location.\n\nIf developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.","status":"published","published":"2026-03-25T16:56:28Z","modified":"2026-03-27T22:07:43Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T14:39:44.97342Z"}],"nvd":[{"id":"CVE-2026-25645","description":"Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.","status":"published","published":"2026-03-25T17:16:52.97Z","modified":"2026-06-17T10:25:00.443Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T14:12:11.077116Z"}],"osv":[{"id":"ALPINE-CVE-2026-25645","description":"Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.","status":"published","published":"2026-03-25T17:16:52.97Z","modified":"2026-10-01T02:17:49.215485894Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2026-25645","status":"published","published":"2026-03-28T06:08:19.822528Z","modified":"2026-04-30T07:18:34.498175Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:23.315185Z"},{"id":"CVE-2026-25645","title":"Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function","description":"Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.","status":"published","published":"2026-03-25T17:02:48.402Z","modified":"2026-10-28T02:31:13.474294862Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T15:44:59.438965Z"},{"id":"DEBIAN-CVE-2026-25645","description":"Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.","status":"published","published":"2026-03-25T17:16:52.97Z","modified":"2026-10-01T03:03:21.743875578Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"GHSA-gc5v-m9x4-r6x2","title":"Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function","description":"### Impact\nThe `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one.\n\n### Affected usages\n**Standard usage of the Requests library is not affected by this vulnerability.** Only applications that call `extract_zipped_paths()` directly are impacted.\n\n### Remediation\nUpgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location.\n\nIf developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.","status":"published","published":"2026-03-25T16:56:28Z","modified":"2026-09-10T03:50:39.207922076Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"OESA-2026-1791","title":"python-requests security update","description":"Requests is an HTTP library, written in Python, as an alternative to Python\u0026amp;apos;s builtin urllib2 which requires work (even method overrides) to perform basic tasks. Features of Requests:  - GET, HEAD, POST, PUT, DELETE Requests:    + HTTP Header Request Attachment.    + Data/Params Request Attachment.    + Multipart File Uploads.    + CookieJar Support.    + Redirection History.    + Redirection Recursion Urllib Fix.    + Automatic Decompression of GZipped Content.    + Unicode URL Support.  - Authentication:    + URL + HTTP Auth Registry.\r\n\r\nSecurity Fix(es):\n\nRequests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.(CVE-2026-25645)","status":"published","published":"2026-04-03T11:10:49Z","modified":"2026-08-18T01:19:44.048820865Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1909","title":"python-pip security update","description":"%changelog * Fri Feb 13 2026 Linux_zhang \u0026amp;lt;244695981@qq.com\u0026amp;gt; - 23.3.1-9 - Fix CVE-2026-21441\r\n\r\nSecurity Fix(es):\n\nRequests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.(CVE-2026-25645)","status":"published","published":"2026-04-17T11:10:55Z","modified":"2026-08-18T01:19:55.350331258Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"PYSEC-2026-2275","description":"Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.","status":"published","published":"2026-03-25T17:16:52.97Z","modified":"2026-07-13T07:15:43.96490219Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"ROOT-APP-PYPI-CVE-2026-25645","title":"CVE-2026-25645 in rootio-requests - Patched by Root","description":"Root has patched CVE-2026-25645 in the rootio-requests package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-07-22T08:25:05Z","modified":"2026-07-22T14:00:18.478585436Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"UBUNTU-CVE-2026-25645","description":"Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.","status":"published","published":"2026-03-25T17:16:00Z","modified":"2026-10-17T12:56:13.171250776Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"AZL-80996","title":"CVE-2026-25645 affecting package python-requests for versions less than 2.31.0-4","description":"Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.","status":"published","published":"2026-03-25T17:16:52Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"CLSA-2026-1780879897","title":"TuxCare security update for requests (1 CVE)","description":"TuxCare rebuilt requests to address 1 CVE. Fixed in 2.32.3.post2+tuxcare.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-15T09:48:01.098101304Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1781225614","title":"TuxCare security update for requests (1 CVE)","description":"TuxCare rebuilt requests to address 1 CVE. Fixed in 2.31.0.post2+tuxcare.","status":"published","published":"2026-08-04T14:52:36Z","modified":"2026-10-15T09:48:01.101515176Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1781225615","title":"TuxCare security update for requests (1 CVE)","description":"TuxCare rebuilt requests to address 1 CVE. Fixed in 2.30.0.post2+tuxcare.","status":"published","published":"2026-08-04T14:52:36Z","modified":"2026-10-15T09:48:01.154110517Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1787551818","title":"TuxCare security update for requests (1 CVE)","description":"TuxCare rebuilt requests to address 1 CVE. Fixed in 2.25.1.post2+tuxcare.","status":"published","published":"2026-08-24T06:10:18Z","modified":"2026-10-15T09:48:05.851871093Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"openSUSE-SU-2026:10455-1","title":"python311-requests-2.33.0-1.1 on GA media","description":"These are all security issues fixed in the python311-requests-2.33.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-28T00:00:00Z","modified":"2026-03-29T10:45:34.462224Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20926-1","title":"Security update for python-requests","description":"This update for python-requests fixes the following issue:\n\n- CVE-2026-25645: `extract_zipped_paths()` uses predictable filenames when extracting files from zip archives and reuses\n  target files that already exist without validation (bsc#1260589).\n","status":"published","published":"2026-06-08T16:38:34Z","modified":"2026-06-10T18:24:15.178629822Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:1218-1","title":"Security update for python-requests","description":"This update for python-requests fixes the following issues:\n\n- CVE-2026-25645: `extract_zipped_paths()` uses predictable filenames when extracting files from zip archives and\n  reuses target files that already exist without validation (bsc#1260589).\n","status":"published","published":"2026-04-08T14:39:49Z","modified":"2026-04-09T08:00:15.42278Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1644-1","title":"Security update for python-requests","description":"This update for python-requests fixes the following issues:\n\n- CVE-2026-25645: `extract_zipped_paths()` uses predictable filenames when extracting files from zip archives and\n  reuses target files that already exist without validation (bsc#1260589).\n","status":"published","published":"2026-04-28T13:31:42Z","modified":"2026-04-30T18:24:24.253028Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:1647-1","title":"Security update for python-requests","description":"This update for python-requests fixes the following issues:\n\n- CVE-2026-25645: `extract_zipped_paths()` uses predictable filenames when extracting files from zip archives and\n  reuses target files that already exist without validation (bsc#1260589).\n","status":"published","published":"2026-04-28T18:03:06Z","modified":"2026-04-30T08:16:07.356313Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:21036-1","title":"Security update for python-requests","description":"This update for python-requests fixes the following issue:\n\n- CVE-2026-25645: `extract_zipped_paths()` uses predictable filenames when extracting files from zip archives and reuses\n  target files that already exist without validation (bsc#1260589).\n","status":"published","published":"2026-04-08T14:30:11Z","modified":"2026-04-14T18:27:32.968145Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:21063-1","title":"Security update for python-requests","description":"This update for python-requests fixes the following issue:\n\n- CVE-2026-25645: `extract_zipped_paths()` uses predictable filenames when extracting files from zip archives and reuses\n  target files that already exist without validation (bsc#1260589).\n","status":"published","published":"2026-04-08T14:11:12Z","modified":"2026-04-14T18:24:55.514124Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:22055-1","title":"Security update for python-requests","description":"This update for python-requests fixes the following issue:\n\n- CVE-2026-25645: `extract_zipped_paths()` uses predictable filenames when extracting files from zip archives and reuses\n  target files that already exist without validation (bsc#1260589).\n","status":"published","published":"2026-06-08T16:27:21Z","modified":"2026-06-10T18:24:16.230615905Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22091-1","title":"Security update for python-requests","description":"This update for python-requests fixes the following issue:\n\n- CVE-2026-25645: `extract_zipped_paths()` uses predictable filenames when extracting files from zip archives and reuses\n  target files that already exist without validation (bsc#1260589).\n","status":"published","published":"2026-06-08T16:27:21Z","modified":"2026-06-16T18:24:39.725413541Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"USN-8825-1","title":"requests vulnerability","description":"It was discovered that Requests did not correctly handle generating\nrandom temporary file paths. An attacker could possibly use this issue\nto execute arbitrary code.","status":"published","published":"2026-09-28T01:58:54Z","modified":"2026-09-28T11:42:42.015352118Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}